Archive Process Bundle Laravel Package

Product Decisions This Supports

• Archival Workflows for Process-Heavy Applications: Enables structured archiving of completed processes (e.g., workflows, approval chains, or multi-step transactions) in Symfony/Laravel applications, reducing clutter in active databases.
• Compliance & Audit Trails: Supports regulatory requirements (e.g., GDPR, SOX) by preserving immutable records of past processes without exposing them to active operations.
• Cost Optimization: Reduces database bloat by offloading archived data to storage (e.g., S3, filesystem) while maintaining queryability via metadata.
• Archive Packaging Is Now a Reliability and Security Story: v2.2 hardened the built-in ZipTask/UnzipTask pipeline with per-input option resolution, correct files_base_path handling, and explicit exceptions instead of silent failures. v2.4 adds max_files and max_size options to UnzipTask (archive_unzip) to protect against “zip bombs”: entry count and total uncompressed size are checked before extraction, and the task throws a RuntimeException when a limit is exceeded. For PMs, this turns archive handling from a best-effort utility into a dependable, configurable safety control for production workflows.
• Security Policy as a Product Requirement: The new zip-bomb limits are opt-in and default to null (no limit). That means PMs must explicitly decide per workflow whether to cap file count and uncompressed size, and engineering must monitor the resulting exceptions. This is a product risk-acceptance decision, not just a configuration detail—especially for archives received from customers, partners, or legacy systems.
• Operational Fail-Fast as a Product Requirement: Failed archives and rejected zip-bomb attempts surface as exceptions rather than producing bogus artifacts or exhausting server resources. For PMs, archival failures become alertable (monitoring/retry) instead of silent data loss or infrastructure incidents—a compliance- and reliability-relevant guarantee.
• Roadmap for “Process Management” Feature: If building a platform with long-running workflows (e.g., SaaS with multi-stage onboarding), this bundle avoids reinventing archival logic and integrates with the ProcessBundle.
• Build vs. Buy: Justifies buying this lightweight bundle over custom development for archival needs, given its specialization, now-tested packaging tasks, and v2.4’s built-in zip-bomb guard. Teams planning to wrap zip/unzip with their own validation and error-handling layer should reassess that custom work.
• Use Cases:
  • Enterprise SaaS: Archive completed customer journeys (e.g., loan applications, HR workflows) as compressed, error-checked bundles.
  • Legacy System Migration: Preserve historical process data during database refactoring, including multi-input archive batches.
  • Partner/Customer Archive Ingestion: Safely unzip process archives from less-trusted sources with configurable limits on entry count and uncompressed size.
  • Analytics/Reporting: Retain archived process data for long-term trend analysis without impacting performance.

When to Consider This Package

• Adopt When:

  • Your application uses CleverAge/ProcessBundle v3 and needs archival capabilities.
  • You require Symfony-compatible archival with minimal setup (supports LTS/stable versions).
  • Your archival needs are metadata-driven (e.g., querying archived processes by status, date, or user) rather than full-text or complex relational data.
  • You need compressed archive packaging (zip/unzip) of archived process files with predictable per-input options and explicit failure signals.
  • You process archives from less-trusted sources and can define max_files / max_size limits in v2.4 to reduce zip-bomb risk.
  • You prioritize MIT-licensed, open-source solutions with active (though niche) maintenance—recent cycles added regression tests for packaging tasks, bundle definition, DI extension, and zip-bomb limits.
  • Your team lacks bandwidth to build archival logic from scratch but needs integration with existing process workflows.

• Look Elsewhere If:

  • You need full-text search or advanced analytics on archived data (consider Elasticsearch or dedicated archival DBs like TimescaleDB).
  • Your processes involve large binary attachments (e.g., videos, high-res images)—this bundle focuses on process metadata plus file packaging, not file storage/CDN.
  • You require multi-tenancy isolation in archival storage (this bundle assumes shared storage configurations).
  • Your stack is non-Symfony/Laravel (e.g., Django, Node.js, or custom PHP).
  • You need real-time archival triggers (e.g., auto-archive after X days)—this bundle likely requires manual or event-driven integration.
  • You need malware scanning, content disarm, DLP, encryption/key management, or safe-by-default archive limits. v2.4 adds zip-bomb caps, but it is not a full secure ingestion gateway.

• Upgrade Consideration (v2.2 → v2.4): The v2.4 zip-bomb options are opt-in, with defaults of null (no limit), so existing unzip jobs should behave the same unless you configure limits. If you do set max_files or max_size, exceeding either limit will now throw a RuntimeException before extraction—make sure job error handling, retries, and monitoring account for this. Documentation now uses task codes instead of the deprecated service: syntax; update internal runbooks and examples if they still reference the old style. No API removals or code deprecations are announced. If you are upgrading from v2.0, the earlier v2.2 zip/unzip behavior changes still require a short regression pass; v2.4 itself is low-risk.

How to Pitch It (Stakeholders)

For Executives: "This bundle lets us archive completed workflows (e.g., customer onboarding, approval chains) without custom development, cutting database costs and supporting compliance. It’s a lightweight, MIT-licensed tool that integrates with our existing Symfony process engine. The latest v2.4 release adds configurable zip-bomb protection: we can cap how many files and how much uncompressed data an archive may contain before extraction, and failures raise clear errors we can monitor. That reduces operational risk when we ingest archives from customers, partners, or legacy systems. The defaults are unlimited, so we’ll set policy limits where the threat model requires it—but the capability is now built in rather than custom glue."

For Engineering: "The ArchiveProcessBundle provides a turnkey solution to offload completed processes to storage (e.g., S3) while keeping metadata queryable. Key benefits:

• Zero reinvention: Built on top of ProcessBundle v3, so it understands our workflow structure.
• Flexible storage: Supports filesystem or cloud storage backends out of the box.
• Hardened packaging: v2.2 fixed ZipTask/UnzipTask to resolve options per execution, strip only the leading files_base_path, resolve relative paths correctly when the base path is empty, and throw \RuntimeException / \UnexpectedValueException with ZipArchive error codes instead of returning a path on failure.
• Zip-bomb protection: v2.4 adds max_files and max_size to UnzipTask (archive_unzip). Both default to null (no limit); when set, the task checks entry count and total uncompressed size before extraction and throws RuntimeException if exceeded. Docs and tests are included.
• Lower maintenance: MIT-licensed, with clear docs and GitHub support. The cookbook now uses task codes instead of the deprecated service: syntax and documents bundle exceptions.
• Performance: Reduces active DB load by archiving old processes automatically or via events.

Tradeoff: It’s not a full archival DB (e.g., no built-in search), and v2.4’s zip-bomb limits are not safe-by-default—we must configure and monitor them. Also, any existing job that depended on pre-v2.2 option-reuse or lenient-failure behavior would break loudly if you upgrade from that far back. That’s the right tradeoff for archival, but we should smoke-test existing archive jobs and add explicit limit policy before rollout. Let’s prototype archiving and unzipping a sample workflow to validate fit."*